refactor(chat): extract composer ownership

[bkudiess]

Summary

• Extract host-local composer state into a WinUI-free ChatComposerViewModel.
• Extract send, lifecycle, stop, reset, queue, model, thinking, catalog, voice, and paste workflows into ChatComposerController.
• Create one transient ChatComposerSession per mounted ChatPage/ChatWindow host through the existing DI container.
• Move declarative composer controls into view-only ReactorChatComposer.
• Reduce OpenClawReactorChatRoot from 1,766 to 428 lines while retaining the sole provider subscription, immutable snapshot, selection, timeline, checkpoint, and scrolling ownership.
• Preserve visible copy, iconography, layout, theme, high-contrast, keyboard, automation, and accessibility behavior.

Ownership transfer

New owner	Responsibility	Explicitly does not own
ChatComposerViewModel	Draft/revision, attachment identities, busy flags, slash presentation, immutable input projection, derived enablement	Provider subscription, runtime state, files, managers, caches, WinUI controls
ChatComposerController	Typed composer workflows, operation cancellation/generation, result fencing	D1 queue admission, timeline/reset/history, named controls, popup/layout
ChatComposerSession / factory	One VM/controller lifetime per mounted host	DI/container lifetime, shared provider state
ReactorChatComposer	Declarative controls, popup, focus/caret, keyboard, automation, theme/high contrast	Provider calls and workflow state
OpenClawReactorChatRoot residue	Provider snapshot/subscription, selected thread, timeline, checkpoint and scroll composition	Composer draft/attachments/slash/voice/send state

ChatPage and compact ChatWindow share provider state but intentionally retain independent drafts, attachments, popup/focus, voice, and operation lifetime.

Correctness and lifecycle

• Immutable composer inputs use monotonic revisions; stale dispatcher applications are rejected.
• Off-thread VM mutations use one FIFO UI-dispatch drain with explicit rejection diagnostics.
• Apply/dispose is linearized; no mutation or notification occurs after disposal.
• Send has a controller-owned interlocked single-flight independent of asynchronously rendered state.
• The controller captures one stable lifetime cancellation token before concurrency; disposal cannot race a later CancellationTokenSource.Token getter.
• Voice and clipboard operation registration plus synchronous host-operation initiation share one narrow gate with disposal. If disposal wins, no host request or GetBitmapAsync begins; if registration wins, initiation occurs before disposal returns and cancellation follows.
• Cancellation callbacks run outside the registration gate, so callbacks may re-enter or wait for controller cleanup without deadlock.
• Voice callbacks/results/final recording state and clipboard results are fenced by disposed state, generation, operation ID, and exact CTS identity. The operation owner alone disposes its CTS.
• Draft and exact attachment identities clear only after accepted sends; in-flight edits/additions survive.
• Paste, voice, send, catalog, model, thinking, stop, and queue operations cancel or generation-fence late completion.
• /compact, /reset, and /new recheck lifetime after each await.
• Mounted host teardown is first-wins and idempotent; missing DI registration fails fast.

Validation

Exact D2 head 53d100a5f431c630bdb4cfb535e983be9b50d3d6, based directly on D1 59096c38182f07e22bb8980951a9c80828f0c01f:

• ./build.ps1: passed
• Shared: 3,412 passed / 32 skipped / 0 failed
• Tray: 2,313 passed / 0 failed
• Gated Integration: 19 passed
• Functional UI: 19 passed
• Native UI: 108 passed
• Accessibility: 20 passed
• Focused controller race suite: 42 passed
• Real WinRT clipboard fencing suite: 6 passed
• Exact tree: bb6b16e6df147f8b2126eebaeed946c2a8d5164e
• git diff --check, source-owner guards, conflict markers, UTF-8, and final-newline checks: clean

The focused barriers cover voice/clipboard dispose-wins and registration-wins ordering, callback reentrancy, cancellation callback waits, supersession, late-result fencing, repeated race stress, idempotent disposal, and real DataPackageView.GetBitmapAsync initiation.

Real behavior proof

Exact-head native UI and Axe.Windows suites exercised the real app across compose, queue, stop, lifecycle, model/thinking, slash, attachment/paste, page/window lifetime, provider replacement, focus, keyboard, automation, live regions, theme/high contrast, scrolling, checkpoints, disposal, late completion, dispatcher ordering, and repeated cleanup.

A fresh disposable real-gateway fixture also validated exact stack head 53d100a5:

• Reached Ready with compose ready, history loaded, queue 0, and no active turn.
• Called app.chat.reset immediately before the real send and observed reset completion.
• The send terminalized naturally in 1.044 seconds through the expected no-provider-key final error path.
• Marker counts remained exactly 1 / 1 / 1 live, after history remount, and after gateway reconnect.
• Gateway transitioned Connecting to Ready; isolated profile/distro/tray cleanup completed; shared marker stayed 0 -> 0; redaction and Git-state checks passed.

Redacted package: d2-operation-gate-proof-53d100a5-20260806-190646
Manifest SHA-256: 3016f4c5e3c4489e0b89df01eb4967eade125c8e209f1767dfc68a47503109b8

Review

• Two independent exact-commit adversarial reviews report clean after the voice/paste registration and cancellation-gate fixes.
• Deterministic review regressions prove the two prior ClawSweeper findings against the old ordering and the corrected behavior at the current head.
• Composer-specific cycles also cover dispose-during-await, post-dispose ingress, model ordering, compact/paste/voice completion, dispatcher races, duplicate sends, stable-token teardown, repeated disposal, and DI fallback behavior.
• D1 reset, lifecycle, history, telemetry, abort, and user-frame isolation regressions pass at the final stacked head.
• No partial or truncated structured-review result was accepted.

Architecture

Adds authoritative and closed ledger rows for composer VM, workflow controller, host lifetime, and Reactor root residue. D1 runtime owners, provider state, queue/history/reset/metadata, timeline rendering, scrolling, and checkpoints remain authoritative.

Stack

Directly based on D1 PR #1096. This is the second/final Chat architecture layer.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 17, 2026, 7:58 PM ET / 23:58 UTC.

ClawSweeper review

What this changes

The PR extracts native chat-composer state, workflows, host lifetime, and declarative controls from the chat root into dedicated components.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

The change is still necessary because current main retains the original nested composer path. The current head resolves the prior mounted-input lifecycle and accessibility blockers; this collaborator-authored PR should remain open for explicit maintainer landing judgment after pending CI completes.

Priority: P1
Reviewed head: edf0c9e7438de00ca1d7a0ef0801906f180eb28e
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The current head addresses prior blockers with focused regression coverage and direct native UI evidence.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (screenshot): The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
Evidence reviewed	6 items	Current-head input lifecycle: The composer assigns the established input automation ID, attaches image-paste handling and the edit flyout on mount, then removes both on unmount. Accessibility recovery: Current code retains layout-gated UI Automation recovery for composer controls, and the current-head comment includes redacted composer, context-menu, and model-picker screenshots. Architecture boundary: The ledger assigns composer state and workflows to the new owners while explicitly closing those responsibilities in the chat root.
Findings	None	None.
Security	None	None.

How this fits together

The native chat surface renders composer controls over gateway-backed conversation state. This PR moves per-host draft, attachment, voice, and send handling into a composer session while the root retains provider subscription and timeline ownership.

flowchart LR
A[Gateway chat provider] --> B[Chat root]
B --> C[Composer session]
C --> D[Composer state]
C --> E[Composer workflows]
D --> F[Composer controls]
E --> F
F --> G[Chat send and attachments]

Loading

Decision needed

Question	Recommendation
Should this collaborator-authored current-head composer extraction be merged once pending required checks complete?	Merge after required checks: Accept the reviewed composer boundary after the pending CI suite passes on the current head.

Why: Collaborator-authored work requires explicit maintainer judgment even when the code-level blockers are resolved.

Before merge

• Resolve merge risk (P1) - This large refactor replaces the native composer path, so pending CI should still gate landing despite the restored input lifecycle and current-head UI proof.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Refactor scope	31 files affected, +5,738/-1,742 lines	The extraction crosses chat state, native controls, host mounting, and focused tests.
Production versus tests	source +2,973, tests +2,758, docs +7	The substantial ownership change is accompanied by nearly matching regression and UI-proof coverage.

Merge-risk options

Maintainer options:

1. Merge after current CI (recommended)
   Merge after pending required checks confirm the reviewed current head retains the native composer contract.
2. Pause for a narrower split
   Keep the refactor open only if maintainers prefer a smaller ownership transfer.

Technical review

Best possible solution:

Land the dedicated composer boundary once required CI passes, preserving mounted TextBox lifecycle, UI Automation IDs, and root-only provider ownership.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this refactor is reviewed against established native composer behavior, and the prior input-lifecycle regressions are source-verified as resolved on the current head.

Is this the best way to solve the issue?

Yes: separating per-host composer state and workflows while retaining provider and timeline ownership in the root matches the architecture ledger and keeps the previous mounted-control behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f8a8825ccbb4.

Labels

Label changes:

• add proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P1: The PR changes the core native chat input workflow, where regressions affect sending, pasting, and accessible controls.
• merge-risk: 🚨 compatibility: It replaces the mounted composer implementation and must preserve keyboard, clipboard, and UI Automation behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (screenshot): The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
• proof: sufficient: Contributor real behavior proof is sufficient. The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence. The current-head comment provides redacted native UI screenshots of the extracted composer, its edit menu, and model picker alongside current-head validation results.

Evidence

What I checked:

• Current-head input lifecycle: The composer assigns the established input automation ID, attaches image-paste handling and the edit flyout on mount, then removes both on unmount. (src/OpenClaw.Tray.WinUI/Chat/ReactorChatComposer.cs:437, edf0c9e7438d)
• Accessibility recovery: Current code retains layout-gated UI Automation recovery for composer controls, and the current-head comment includes redacted composer, context-menu, and model-picker screenshots. (src/OpenClaw.Tray.WinUI/Chat/ReactorChatComposer.cs:1220, edf0c9e7438d)
• Architecture boundary: The ledger assigns composer state and workflows to the new owners while explicitly closing those responsibilities in the chat root. (docs/ARCHITECTURE.md:232, edf0c9e7438d)
• Main baseline: Current main still contains the prior nested composer implementation, so this work is neither implemented nor obsolete there. (src/OpenClaw.Tray.WinUI/Chat/OpenClawReactorChatRoot.cs:429, f8a8825ccbb4)
• Feature history: Blame ties the original root send behavior to the main-line release snapshot, while the extracted composer lifecycle is attributed to the current PR head. (src/OpenClaw.Tray.WinUI/Chat/OpenClawReactorChatRoot.cs:429, 4206611f2b2e)
• Structured-review helper: The helper could not form a bounded commit review because this checkout presents the PR head as a grafted root with unrelated binary assets; direct source and history inspection was used instead. (edf0c9e7438d)

Likely related people:

• Scott Hanselman: Current-main blame identifies the original chat-root composer and send behavior being extracted. (role: prior feature owner; confidence: medium; commits: 4206611f2b2e; files: src/OpenClaw.Tray.WinUI/Chat/OpenClawReactorChatRoot.cs, src/OpenClaw.Tray.WinUI/Chat/ReactorChatHostExtensions.cs)
• karkarl: Recent commits restored composer accessibility and send-fault observation, and current-head UI proof was posted from that head. (role: recent area contributor; confidence: high; commits: 89a9cee45ab5, edf0c9e7438d; files: src/OpenClaw.Tray.WinUI/Chat/ReactorChatComposer.cs, src/OpenClaw.Tray.WinUI/Chat/OpenClawReactorChatRoot.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Let pending required CI complete on the current head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (29 earlier review cycles; latest 8 shown)

• reviewed 2026-08-08T15:47:18.365Z sha 53d100a :: needs changes before merge. :: [P1] Reattach paste and context-menu wiring to each text box
• reviewed 2026-08-09T00:05:57.608Z sha 53d100a :: found issues before merge. :: [P1] Wire every mounted text box to paste and edit-menu behavior
• reviewed 2026-08-09T03:16:52.394Z sha 53d100a :: needs changes before merge. :: [P1] Reattach paste and edit-menu behavior for every text box | [P1] Carry forward the composer accessibility recovery
• reviewed 2026-08-09T09:27:54.690Z sha 53d100a :: needs changes before merge. :: [P1] Bind paste and edit-menu behavior on every input mount | [P1] Carry forward composer accessibility recovery
• reviewed 2026-08-09T12:00:11.420Z sha 53d100a :: needs changes before merge. :: [P1] Reattach paste and edit-menu behavior on every input mount | [P1] Restore composer accessibility recovery and automation IDs
• reviewed 2026-08-09T14:51:34.076Z sha 53d100a :: needs changes before merge. :: [P1] Bind paste and the edit flyout on every input mount | [P1] Restore composer accessibility recovery and control IDs
• reviewed 2026-08-09T22:30:07.457Z sha 53d100a :: found issues before merge. :: [P1] Restore per-mount paste and edit-flyout wiring | [P1] Carry forward composer accessibility recovery and IDs
• reviewed 2026-08-17T23:34:12.733Z sha 53d100a :: found issues before merge. :: [P1] Restore per-mount paste and edit-flyout wiring | [P1] Preserve composer accessibility recovery and control IDs

[bkudiess]

Fixed the ClawSweeper P2 on head e666bb83.

• Captured one stable lifetime CancellationToken during controller construction; send, stop, queue cancel, model set/clear, thinking, and catalog calls never read CancellationTokenSource.Token after disposal can race.
• Dispose still cancels and disposes the source exactly once; the captured token remains safely canceled and usable by downstream registration/WaitAsync paths.
• Added deterministic send-versus-dispose and fire-and-forget-versus-dispose barriers, cancellation propagation checks, and race stress. Each load-bearing test was verified to fail against the old getter behavior.
• Test hooks compile only in the source-linked OPENCLAW_TRAY_TESTS build, not the WinUI product.
• Build, Shared 3399+32 skipped, Tray 2159, FunctionalUI 19, gated Integration 19, Native UI 102, Accessibility 19, and final Opus/Sol reviews are clean.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31056719707
• Updated: 2026-08-05T23:32:42.412Z

[bkudiess]

Updated exact stacked head 2325e698 on fixed D1 67d8a8b5. The stable-token teardown fix remains byte-identical and all ClawSweeper race regressions pass. Build, Shared, Tray 2162, D1 hardening 301, D2 focused 77, FunctionalUI 19, gated Integration 19, Native UI 102, and Accessibility 19 are green.

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/31070117131
• Updated: 2026-08-06T04:02:47.783Z

[karkarl]

Current-head UI proof (PII redacted)

Captured from the isolated synthetic chat provider at edf0c9e7438de00ca1d7a0ef0801906f180eb28e. Potential account/search/status chrome was blurred, visible text was checked for local aliases, paths, email addresses, tokens, and secrets, and all unredacted raw captures were deleted.

Composer draft and controls

Native composer context menu

Model picker

Validation on this head: full build passed; Shared 3698 passed / 32 skipped; Tray 2619 passed; ARM64 WinUI 143 passed; live A2UI integration 1 passed.